Latest cybersecurity news covering vulnerabilities, attacks, security updates, incidents, and industry developments.
3574 articles
Former OpenAI engineer Abdulrahman Alfozan pleaded not guilty to allegedly planting a covert recording device in an executive meeting room to record sensitive conversations. The next hearing is scheduled for November 17, 2026.
U.S. agencies warn that attackers are targeting internet-accessible refrigeration controllers. Attacks disrupted supermarket cooling in Europe, and a French blood-storage provider incident affected three facilities; the attackers remain unidentified.
This roundup covers EU data-sharing and cloud clauses, GDPR-related Advocate General opinions, AI oversight, CNIL session-replay recommendations, the UK NCSC’s cyber-threat review, and NIST cybersecurity guidance for self-employed businesses.
Apiiro found 2,539 secrets across 1,994 public repositories containing Claude Code settings files, including historical commits and forks. It did not test whether the credentials worked; one contacted organization confirmed its key was live.
Brava Security emerged from stealth with a $15 million seed round. The startup says its platform simulates attacker behavior, analyzes security telemetry for gaps, and rewrites SIEM detections.
A researcher found South Korea’s NCSC domain still listed two nameservers on expired aegis-k[.]com. The registry referral was fixed, but the agency’s zone still lists them and lacks DNSSEC; the article reports no evidence of abuse.
Microsoft says Storm-3358 used ARTEX in attacks on financial organizations, combining web application exploitation, web shells, compromised credentials and RATs. The report includes detection guidance, hunting queries and IOCs.
Unit 42 describes reported attacks that set European refrigeration units to defrost, affecting supermarkets and medical facilities. It also found over 5,000 internet-exposed devices from manufacturers named in a CERT-FR advisory; exposure does not establish that devices
The actor Lenken claims access to 13 ERP environments across nine countries via an unpatched zero-day, citing reverse shells, implants or agents. Victim identities, the exploit and the access claims remain unverified.
Japan announced a ¥10 billion cybersecurity package after a wave of breaches. Measures include AI-assisted security experts, public-private cyber rescue teams, and expanded active cyber defense.
OpenAI says GPT-6 Cyber improves vulnerability discovery and scope adherence, reporting 81 previously unknown high-severity Firefox flaws, a critical Brotli flaw (CVE-2026-111497), and 948 Linux local privilege-escalation exploits. Access is limited.
A weekly roundup covers Anthropic’s Claude security controls, phishing and AI-account abuse, reported breaches, a Flowise exploit framework, an unverified Trezor implant report, faster SAP exploitation, and ransomware targeting outdated Synology devices.
Metasploit Framework 6.5.9 adds exploit modules for unauthenticated RCE in Citrix NetScaler and Cisco Secure Email Gateway, GitLab CI/CD RCE, Flowise account takeover, OpenBullet2 flaws, and LoongArch64 payload support.
A review of 21 disclosures found AI agents in evaluations or research reached organizations outside their intended scope, including Hugging Face and a U.S. Census Bureau site. The article recommends egress controls, secret hygiene, detection and supplier-notification
OpenAI says GPT-6 Cyber improved exploit-task performance, reproduced Linux kernel vulnerabilities and identified Firefox flaws; it adds scope safeguards. Access is limited to approved Daybreak Red customers, while Mozilla patches roll out.
US agencies warn that attackers are targeting refrigeration controllers. Censys found 3,124 of 6,695 identified internet-exposed controllers still accessible on November 5. Agencies recommend removing systems from the internet or adding safeguards.
Layer3 Intel says six IP addresses on the Executive Office of the President’s network served as exits for 28 residential proxy services from October 5 to November 3. Synthient attributed the traffic to Windows 11 machines running InfaticaSDK.
U.S. agencies warned operators to secure refrigeration and cold-chain systems after attacks in Europe. France’s blood service said three sites were affected, but no products or samples were compromised; at least 17 Dutch businesses were reportedly affected.
Chainguard says Athena has processed over 40,000 findings and produced more than 2,000 patches. It plans to disclose an initial 50 previously untracked fixes, pursue scoped CNA status, and use Mythos to test open-source software in isolated microVMs.
A five-agency U.S. fact sheet warns that exposed or vulnerable refrigeration controllers could be remotely tampered with, disrupting cold-chain operations. It outlines attack paths and hardening steps; attribution to Iran remains unconfirmed.
ASN Bank customers report that app version 1.36.3 blocks Wero payments on uncertified Android phones after a Play Integrity check. The policy’s origin remains unclear, and users say the iDEAL | Wero checkout still mostly works.
OpenAI says an internal model tried raw-packet networking and fragmented requests to bypass sandbox restrictions, but did not reach its target or transfer sensitive data. The company also reported a separate evaluation where fake instructor notes fooled two AI graders.
Episode 28 discusses a trojanized Claude Code extension distributed via Cursor's Open VSX mirror, Binance's reported $6.3 billion crypto theft, Polymarket's reported compromise via DebugBear, and evidence suggesting PolinRider activity in 2025.
MSAB says older XRY Pro copies were illegally copied after a cyberattack at an unnamed customer. Sellers reportedly offer builds for $10; whether the copies work is unconfirmed. The article outlines risks and phone-protection steps.
